first impressions of the Lego smart brick, before I do any actual tearing down: wow, I forgot how good they are at working with plastic.

[whitequark@social.treehouse.systems]

not my best work but it should do the trick

feat. comically big q-tip

[dev@discuss.systems]

@whitequark oh lol I thought it was a cat’s paw

[whitequark@social.treehouse.systems]

@dev that would be a really small cat

[whitequark@social.treehouse.systems]

unfortunately, i could not access JTAG. i think i ran out of time i have for playing with this board, good luck @ everyone else

shout out to:
https://github.com/nanash1/smart_brick
https://codeberg.org/shelfofsheelfs/SMART-Brick
for doing good work!

[whitequark@social.treehouse.systems]

after reading the datasheet a bit more carefully, i know why i couldn't: the JTAG port is simply not exposed unless the firmware configures the pin mux that way. i'd have to dump the firmware in some other way

[cinebox@masto.hackers.town]

@whitequark oh how fun, but makes sense for such a pin-constrained device. Is there any other way to access it or is the chip just impossible to reprogram it if it doesnt expose JTAG?

[whitequark@social.treehouse.systems]

@cinebox it has a bootloader which I assume is how it's programmed by LEGO; I think I know how to trigger that but I just wanted to connect JTAG because it was more challenging to solder these tiny wires and I'm bad at doing it

[ldcd@social.treehouse.systems]

@whitequark could it have booted in cJTAG mode?

[whitequark@social.treehouse.systems]

@ldcd the datasheet explicitly says the JTAG pins are GPIO'd

[lenary@types.pl]

@whitequark are the pips on top buttons too?

[whitequark@social.treehouse.systems]

@lenary no, just normal lego brick shape

[sounddrill@infosec.exchange]

@whitequark I know this seems like an ordinary jump to you but if I managed to get one as clean as this, I'd feel like a goddamn hero

I ruined a beautiful rf01(one of those xbox 360 donor rf recievers wired through usb) with my soldering

Then it died but I think that was because I wasn't supplying the right power the right way(iirc it wanted a stable 3.3v and I just gave it a nodemcu 3v3) which was a common problem on these boards

[whitequark@social.treehouse.systems]

@sounddrill if you're in the area I can teach you how to do it as cleanly as this. nothing special about it

[arclight@oldbytes.space]

@whitequark This is wonderful

[whitequark@social.treehouse.systems]

@triplef that would have to involve the totally undocumented ASIC

[whitequark@social.treehouse.systems]

@triplef honestly the easiest way would be to join LEGO and get all the docs. I probably could do this if I wanted

[sounddrill@infosec.exchange]

@whitequark I'm way out in South India but hey, thanks!

I first learned basics of PCB design years ago over a discord server so I'll be sure to ask if I need to pick something up

[ldcd@social.treehouse.systems]

@whitequark yup i only mention because TMSC (GPIO11) and TCKC (GPIO10) both go straight to vias (and then maybe to the array of testpoints on the back?); Wheras TDO (GPIO9) seems to go to the flash and TDI (GPIO8) seems to go ??.

So I was thinking there's a chance they might be explicitly configuring it as cJTAG and using it for a boundary scan test after manufacture.

[ldcd@social.treehouse.systems]

@whitequark if the REd schematic is to believed TCKC goes only to a testpoint

[whitequark@social.treehouse.systems]

@ldcd hm it's possible but i haven't implemented cJTAG yet so can't easily test